Forum Discussion

Karthik_Kumaran's avatar
Karthik_Kumaran
Icon for Nimbostratus rankNimbostratus
Feb 02, 2017

BIG-IP DNS - Response to SRV request in Authoritative screening mode?

What does the GTM do for an SRV request when running in authoritative screening mode? I have a listener and a backend pool of DNS servers attached to the listener.

if i query the DNS server directly for the SRV record i get the expected response. But when i point to the GTM and do the same, i get the following error (Unspecified error),

C:\>nslookup
Default Server:  xxx.xxx.com
Address:  10.xx.xx.37

> server 10.xxx.xxx.5
Default Server:  [10.xxx.xxx.5]
Address:  10.xxx.xxx.5

> set q=SRV
> _xxx._xxx.xxx._xxx.xx._xxx.xxx.xxx.com
Server:  [10.xxx.xxx.5]
Address:  10.xxx.xxx.5

*** [10.xxx.xxx.5] can't find _xxx._xxx.xxx._xxx.xx._xxx.xxx.xxx.com: Unspecified error
`


I am running a tcpdump on the GTM while doing this to see what happens, this is what is see,

`10.x.a.67 - Client IP
10.x.b.5 - GTM listener
10.x.b.4 - BIG-IP self-ip
10.x.c.37 - DNS server in the pool added to Listerner.

     [root@labf5:ModuleNotLicensed:Active:Standalone] config  tcpdump -nni 0.0 | grep omain
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes
    05:33:54.106533 IP 10.x.a.67.54272 > 10.x.b.5.53:  86+[|domain]
    05:33:54.107738 IP 10.x.b.4.54272 > 10.x.c.37.53:  86+[|domain]
    05:33:54.345654 IP 10.x.c.37.53 > 10.x.b.4.54272:  86 NXDomain*[|domain]
    05:33:54.345681 IP 10.x.b.5.53 > 10.x.a.67.54272:  86 NXDomain*[|domain]
    05:33:54.551523 IP 10.x.a.67.54273 > 10.x.b.5.53:  87+[|domain]
    05:33:54.552746 IP 10.x.b.4.54273 > 10.x.c.37.53:  87+[|domain]
    05:33:54.757074 IP 10.x.c.37.53 > 10.x.b.4.54273:  87 NXDomain[|domain]
    05:33:54.757097 IP 10.x.b.5.53 > 10.x.a.67.54273:  87 NXDomain[|domain]
    05:33:54.968890 IP 10.x.a.67.54274 > 10.x.b.5.53:  88+[|domain]
    05:33:54.969315 IP 10.x.b.4.54274 > 10.x.c.37.53:  88+[|domain]
    05:33:55.189095 IP 10.x.c.37.53 > 10.x.b.4.54274:  88 NXDomain[|domain]
    05:33:55.189121 IP 10.x.b.5.53 > 10.x.a.67.54274:  88 NXDomain[|domain]
    05:33:55.406590 IP 10.x.a.67.54275 > 10.x.b.5.53:  89+[|domain]
    05:33:55.407788 IP 10.x.b.4.54275 > 10.x.c.37.53:  89+[|domain]
    05:33:55.612583 IP 10.x.c.37.53 > 10.x.b.4.54275:  89 NXDomain[|domain]
    05:33:55.612605 IP 10.x.b.5.53 > 10.x.a.67.54275:  89 NXDomain[|domain]
    05:33:55.823603 IP 10.x.a.67.54276 > 10.x.b.5.53:  90+[|domain]
    05:33:55.824794 IP 10.x.b.4.54276 > 10.x.c.37.53:  90+[|domain]
    05:33:56.029228 IP 10.x.c.37.53 > 10.x.b.4.54276:  90 NXDomain[|domain]
    05:33:56.029254 IP 10.x.b.5.53 > 10.x.a.67.54276:  90 NXDomain[|domain]
    05:33:56.234594 IP 10.x.a.67.54277 > 10.x.b.5.53:  91+[|domain]
    05:33:56.235796 IP 10.x.b.4.54277 > 10.x.c.37.53:  91+[|domain]
    05:33:56.440292 IP 10.x.c.37.53 > 10.x.b.4.54277:  91*|[|domain]
    05:33:56.440320 IP 10.x.b.5.53 > 10.x.a.67.54277:  91*|[|domain]
    05:33:56.512698 IP 10.x.b.4.33659 > 10.x.c.37.53:  25701 updateM [b2&3=0x6661] [29728a] [30060q] [29541n] [28260au][|domain]

The GTM seems to forward the request to the backend DNS server (10.x.c.37) in the pool attached to the listener (but not seen as an SRV query though), but the backend DNS server is responding a non-existent domain (NXDOMAIN).

But if i do a dig directly from the BIG-IP kernel to the DNS server, i get a proper SRV response. So want to verify, what the GTM does in authoritative screening mode for SRV query. The GTM does seem to forward the request to the backend Pool, but why we get an error when going through the listener and not when going directly to the server from BIG-IP command line is what is confusing, Anyone has a good understanding of this?

1 Reply

  • Is it even possible to forward SRV queries coming to a listener to a backend Pool of servers, that way making the GTM respond to SRV queries?? This query is for 11.x version.